Catalog: rein-openweights AppRole for non-interactive OpenRouter key read

Proposed by ops-mason (MASON-WP-0001-T05), built and approved 2026-07-27
(Bernd Worsch). New pointer-only entry mirroring
agent-harness-binky-mail-approle's shape: AppRole login, no operator
present, scoped to exactly one KV path (reins/rein-openweights/openrouter,
new reins/ KV v2 mount -- no existing mount fit without widening scope
beyond what was approved). status: draft until the founder completes
paste-once-provision and glas-harness/GLAS-WP-0002-T02's live
verification succeeds.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

registry/routing/catalog.yaml

@@ -534,3 +534,36 @@ entries:
     canon_ref: net-kingdom/docs/platform-identity-security-architecture.md
     reviewed: "2026-06-24"
     status: draft
+
+  - id: rein-openweights-openrouter-approle
+    title: rein-openweights AppRole for non-interactive OpenRouter key read
+    need_keywords: [rein-openweights, approle, openrouter, glas-harness, unattended, REIN_OPENWEIGHTS_APPROLE_DIR]
+    owner_repo: ops-mason
+    subsystem: OpenBao AppRole + rein-openweights
+    warden_executes: false
+    wiki_ref: wiki/playbooks/rein-openweights-openrouter-approle.md#worker-checklist
+    canon_ref: ops-mason/plans/rein-openweights-openrouter-approle.md
+    reviewed: "2026-07-27"
+    status: draft
+    risk: standard
+    # Built 2026-07-27 by ops-mason (MASON-WP-0001-T05), approved by Bernd
+    # Worsch 2026-07-27. Policy + AppRole live; reins/ KV v2 mount created
+    # (no existing mount fit without widening scope beyond what was
+    # approved). token_num_uses corrected from OpenBao's own default (0 =
+    # unlimited) to 8, matching agent-harness-binky-mail, after the live
+    # config was checked post-build. Status stays draft until the founder
+    # completes paste-once-provision and GLAS-WP-0002-T02's live
+    # verification succeeds -- then promote to active.
+    auth_method: "AppRole login role=rein-openweights (role_id+secret_id via REIN_OPENWEIGHTS_APPROLE_DIR)"
+    path_template: "reins/rein-openweights/openrouter"
+    fetch_command: "bao write -field=token auth/approle/login role_id=$ROLE_ID secret_id=$SECRET_ID  # then bao kv get -field=api_key reins/rein-openweights/openrouter"
+    exec_capable: false
+    lane: secret
+    rotation:
+      method: rotate
+      owner: ops-mason
+      automatable: false
+      steps:
+        - "bao write -f auth/approle/role/rein-openweights/secret-id -> new secret_id; deliver mode-0600 to REIN_OPENWEIGHTS_APPROLE_DIR; shred old secret_id file."
+        - "Optionally re-mint the OpenRouter key itself if it rotated independently."
+        - "Verify AppRole login + field presence (length only); confirm default/other policies still deny sibling paths."